How to Generate a Hash Salt for Drupal

What is a Hash Salt? 

A "hash salt" is a security technique used to enhance the protection of user passwords on websites. It is a randomly generated unique value for each user that is added to the password before the hashing process. This combination of password and salt is then converted into a random string of characters, called a "hash".

Adding salt makes brute force attacks and dictionary attacks much more difficult because even common passwords will have different hashes due to the use of salt. This adds an extra layer of complexity and makes retrieving the original passwords practically impossible without knowing the salt value. Therefore, using hash salts is an essential element of website security, helping to protect users' confidential information and prevent data breaches.

How to generate the Hash Salt using the terminal 

Simply type the following line in a terminal of your choice:

drush eval "var_dump(Drupal\Component\Utility\Crypt::randomBytesBase64(55))"

You will get a long string of characters like the one below:

string(74) "HM-IC11fTynJKT2hIgGVY6GyA_ONs5KHL6ZW3-iQOS2Lli1HukIA73MfeYBCUvLI8aL1H12Qvg"

Copy the "string" value and paste it into your /sites/default/settings.php file, like this:

$settings['hash_salt'] = 'HM-IC11fTynJKT2hIgGVY6GyA_ONs5KHL6ZW3-iQOS2Lli1HukIA73MfeYBCUvLI8aL1H12Qvg';

And that's it!